b3c092b3592bdc6d73d99c56eecf65e3fa2bf9d0723d9ef8bf78346078b0e0d1

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-10_31727b3d0b01b86e7b470388427ad0b0_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Size 12.3MB
Sample260510-phfvcsbs4n
SHA256 b3c092b3592bdc6d73d99c56eecf65e3fa2bf9d0723d9ef8bf78346078b0e0d1
MD5 31727b3d0b01b86e7b470388427ad0b0
SHA1 533d45c89b71e54ec3dd91d579636f73928d4a5e
SHA512 f6beec8ddb9c6113278c6357a10d61725ccf0e987a5e6fff408f2037534f8c0755d5439df34cdb7c4b93282ad46a3558a264efe5284d016b75d9b21375c101e5
SSDEEP 98304:485fk8fJ8SW3d66wgQOCXz66q04KG2Z1/E:RkjXdPUOCXU0nG
TLSH
T142D64B01FE8B94F5F903583140ABB27F23315D098B28CBD7FB547A6AF8776A11C6A245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	4444	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-10_31727b3d0b01b86e7b470388427ad0b0_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-10_31727b3d0b01b86e7b470388427ad0b0_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-10_31727b3d0b01b86e7b470388427ad0b0_coinminer_dosia_elex_glassworm_hive_poet-rat_quasar-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 228
  2⤵
  - Program crash
  PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4444 -ip 4444
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads